Elementor #2394 – Kazumaconsulting

can Azure devops be used for test plans for landing zone builds

Yes, Azure DevOps can definitely be used for test plans for landing zone builds, though with some considerations based on your testing scope and Azure environment.

✅ Azure DevOps Test Plans for Landing Zone Testing

What You Can Test with Azure DevOps:

Infrastructure-as-Code (IaC) Validation
- Unit testing Terraform/Bicep/ARM templates
- Integration testing of resource dependencies
- Security compliance checks (using tools like Checkov, Terrascan)
Pipeline & Deployment Testing
- Deployment success/failure scenarios
- Rollback procedures
- Pipeline integration tests
Configuration Testing
- Network connectivity tests
- DNS resolution
- RBAC permission validations
- Policy enforcement checks

Typical Test Types for Landing Zones:

Test Category	Azure DevOps Capability	Recommended Approach
Unit Tests	✅ Excellent	Use Pester (PowerShell), Terratest (Go), or built-in tasks
Integration Tests	✅ Good	Pipeline stages with environment deployment
Compliance Tests	⚠️ Partial	Integrate with Azure Policy, Security Center
Performance Tests	⚠️ Limited	Use Azure Load Testing (separate service)
Security Tests	⚠️ Partial	Integrate security scanning tools

📋 Implementation Approaches:

Using Azure DevOps Test Plans Module

yaml

# Example pipeline with testing stages

stages:

– stage: Validate

jobs:

– job: IaC_Validation

steps:

– script: terraform validate

– script: terraform plan

– stage: Deploy_Test_Environment

jobs:

– job: Deploy_Test_LZ

steps:

– script: terraform apply -auto-approve

– stage: Run_Tests

jobs:

– job: Execute_Test_Suite

steps:

# Run connectivity tests

– script: Test-NetworkConnectivity.ps1

# Run security scans

– script: Run-SecurityScan.ps1

Test Case Management

Azure DevOps Test Plans allows you to:

Create manual test cases for landing zone validation
Define test suites for different scenarios (baseline, enterprise, etc.)
Track test results and defects
Link tests to requirements/work items

Integration with Other Azure Services

yaml

# Comprehensive testing approach

– task: AzurePolicyAudit@2

– task: AzureResourceGroupDeployment@3

– task: AzureCLI@2

inputs:

script: |

# Test network peering

# Test private endpoints

# Validate logging configuration

⚠️ Limitations & Considerations:

Infrastructure-Specific Testing
- Azure DevOps isn’t optimized for cloud infrastructure testing
- Consider Azure Native Tools for specific scenarios:
  - Azure Policy for compliance testing
  - Azure Monitor for operational validation
  - Azure Security Center for security posture
Performance & Load Testing
- For landing zone performance testing, use:
  - Azure Load Testing (standalone service)
  - Azure Network Watcher for network tests
Cost Management Testing
- Azure DevOps doesn’t have built-in cost validation
- Integrate with Azure Cost Management APIs

🏆 Recommended Hybrid Approach:

Best Practice Architecture:

text

Azure DevOps Pipeline

├── Stage 1: Static Analysis

│ ├── Code Quality (SonarQube)

│ ├── Security Scanning (Checkov/Snyk)

│ └── Template Validation

├── Stage 2: Deployment to Test Environment

├── Stage 3: Automated Testing

│ ├── Infrastructure Tests (Pester/Terratest)

│ ├── Integration Tests (Azure CLI/PowerShell)

│ └── Compliance Checks (Azure Policy)

└── Stage 4: Manual Validation (Test Plans)

├── Governance Review

├── Security Review

└── Operational Readiness

🔧 Useful Extensions & Tools:

Pester for PowerShell testing
Terratest for Terraform testing
Azure DevOps Test Plans for manual test case management
Azure Pipeline Templates for reusable test patterns

📊 When to Use Azure DevOps vs. Other Tools:

Use Case	Azure DevOps	Alternative
Manual test case tracking	✅ Good	–
Infrastructure unit testing	✅ Good	Terratest, Pester
Compliance validation	⚠️ Integrate	Azure Policy
Performance testing	❌ Poor	Azure Load Testing
Security penetration testing	❌ Poor	Microsoft Defender

Conclusion:

Yes, Azure DevOps can be effectively used for landing zone test plans, particularly for:

IaC validation and deployment testing
Manual test case management
Integration with CI/CD pipelines

However, for comprehensive landing zone validation, you should augment Azure DevOps with Azure-native services (Policy, Security Center, Monitor) and specialized infrastructure testing tools.

Recommendation: Use Azure DevOps as your test orchestration and tracking platform, while leveraging specialized Azure services for domain-specific validation.

Xxx

give me a list of azure landing zone services that will be required by a workload subscription for a secure development environment

Here’s a comprehensive list of Azure Landing Zone services typically required for a secure development workload subscription:

Identity & Access Management

Azure Active Directory Premium P1/P2 (via parent/identity subscription)
Azure AD Privileged Identity Management (via identity subscription)
Managed Identities (user-assigned and system-assigned)

Networking & Connectivity

Virtual Network with appropriate subnets (dev, test, etc.)
Network Security Groups with dev-appropriate rules
Azure Firewall Premium (centralized or local)
Private Endpoints for PaaS services
Azure Bastion for secure VM access
Route Tables (UDRs)
Azure DNS Private Zones

Security & Compliance

Microsoft Defender for Cloud (Standard/Premium)
Azure Policy (with built-in and custom policies)
Azure Key Vault Premium
Azure Security Center integrated policies
Microsoft Sentinel (centralized log aggregation)

Monitoring & Logging

Log Analytics Workspace (centralized or dedicated)
Azure Monitor
- Application Insights
- VM insights
- Container insights
Azure Activity Logs (routed to central workspace)
Diagnostic Settings for all services

Management & Governance

Resource Groups with appropriate tagging
Management Groups hierarchy alignment
Azure Blueprints or Bicep/Terraform deployment
Update Management Center
Azure Automation Account (for runbooks)

Compute & Development Services

Azure Container Registry Premium (with geo-replication)
Azure Kubernetes Service (with Azure AD integration)
App Service (with VNet integration)
Azure DevOps (or GitHub Enterprise)
Azure Virtual Machines (with Azure Disk Encryption)
Azure DevTest Labs (optional, for sandbox environments)

Storage & Data

Azure Storage Accounts (with Private Endpoints)
Azure SQL Database (with Advanced Data Security)
Cosmos DB (with Private Endpoints)
Azure Files (with Private Endpoints)
Backup Vault (or centralized backup solution)

Integration & Messaging

Azure Service Bus Premium (with VNet integration)
Event Grid (with Private Endpoints)
API Management Developer tier (with VNet integration)

Cost Management

Azure Cost Management + Billing
Budgets and alerts
Tags for chargeback/showback

Special Considerations for Dev Environments:

Isolation: Separate VNets with peering to shared services
Relaxed Policies: Some policies might be less restrictive than production
Self-Service: Azure DevOps pipelines with approval gates
Quotas: Higher limits for experimentation
Automated Shutdown: For cost optimization on non-production resources

Centralized Services (Typically from Connectivity/Management Subs):

ExpressRoute/VPN Gateway (connectivity subscription)
Azure Firewall Policy (centralized management)
Log Analytics Workspace (centralized)
Shared Image Gallery (centralized)
Domain Controller (centralized)

Recommended Azure Policy Sets:

Deploy Microsoft Defender for Cloud
Require tags on resources
Enforce NSG flow logs
Audit storage account public access
Deploy SQL threat detection
Enforce Private Endpoints for PaaS services

This setup follows the Azure Landing Zone conceptual architecture with appropriate security controls while allowing developers the flexibility needed for development activities.

This response is AI-generated, for reference only.

draw me a network diagram of the above for a non-production tenant in a single region

I’ll create a network diagram for a non-production tenant in a single region following Azure Landing Zone principles. Here’s the conceptual diagram:

text

┌─────────────────────────────────────────────────────────────────────────────┐

│ NON-PRODUCTION TENANT (Single Region) │

│ Azure Region: [e.g., East US 2] │

└─────────────────────────────────────────────────────────────────────────────┘

│ HUB NETWORK (Shared Services) │

│ VNet: np-hub-vnet-eastus2 (10.1.0.0/16) │

│ │ │ │

▼ ▼ ▼ ▼

┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐

│ Azure │ │ ExpressRoute│ │ VPN Gateway │ │ Azure DNS │

│ Firewall │ │ / VPN │ │ (Optional) │ │ Private │

│ Premium │ │ Gateway │ │ │ │ Zones │

│ (10.1.0.4) │ │ │ │ │ │ │

└─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘

│ │ │ │

│ └──────┬───────┘ │

│ │ │

▼ ▼ ▼

┌─────────────────────────────────────────────────────────┐

│ Hub Subnets: │

├─────────────────────────────────────────────────────────┤

│ • AzureFirewallSubnet (10.1.0.0/26) │

│ • GatewaySubnet (10.1.0.64/27) │

│ • ManagementSubnet (10.1.0.96/28) – Azure Bastion │

│ • SharedServicesSubnet (10.1.1.0/24) │

└─────────────────────────────────────────────────────────┘

│ │ │

▼ ▼ ▼

│ VNET PEERING │

│ Bi-directional peering between Hub and Spoke VNets │

│ │ │

▼ ▼ ▼

┌─────────────────────┐ ┌─────────────────────┐ ┌─────────────────────┐

│ SPOKE 1: │ │ SPOKE 2: │ │ SPOKE 3: │

│ DEVELOPMENT │ │ TEST/QA │ │ BUILD/PIPELINE │

│ VNet: np-dev-vnet │ │ VNet: np-qa-vnet │ │ VNet: np-build-vnet│

│ (10.2.0.0/16) │ │ (10.3.0.0/16) │ │ (10.4.0.0/16) │

├─────────────────────┤ ├─────────────────────┤ ├─────────────────────┤

│ Subnets: │ │ Subnets: │ │ Subnets: │

│ • Web (10.2.1.0/24) │ │ • Web (10.3.1.0/24) │ │ • Agents (10.4.1.0/24)│

│ • App (10.2.2.0/24) │ │ • App (10.3.2.0/24) │ │ • Build (10.4.2.0/24) │

│ • Data (10.2.3.0/24)│ │ • Data (10.3.3.0/24)│ │ • Release (10.4.3.0/24)│

│ • PrivateEndpoints │ │ • PrivateEndpoints │ │ • PrivateEndpoints │

│ (10.2.4.0/24) │ │ (10.3.4.0/24) │ │ (10.3.4.0/24) │

└──────────┬──────────┘ └──────────┬──────────┘ └──────────┬──────────┘

│ │ │

▼ ▼ ▼

│ Key Services: │ │ Key Services: │ │ Key Services: │

│ • AKS Cluster │ │ • Test VMs │ │ • Azure DevOps │

│ • App Service │ │ • Test Databases │ │ Agents │

│ (ILB ASE) │ │ • Load Testing │ │ • GitHub Runners │

│ • VM Scale Sets │ │ Services │ │ • Container │

│ • Azure Spring Apps│ │ • Selenium Grid │ │ Registry │

│ • DevTest Labs │ │ • API Testing │ │ • Artifact Feeds │

└─────────────────────┘ └─────────────────────┘ └─────────────────────┘

│ │ │

▼ ▼ ▼

│ PRIVATE ENDPOINT CONNECTIVITY │

│ (All PaaS services connect via Private Endpoints in spoke VNets) │

│ │ │

▼ ▼ ▼

│ CENTRALIZED PAAS SERVICES (Private Link) │

├─────────────────────────────────────────────────────────────────────────────┤

│ • Azure Key Vault (Central) • Azure SQL (Dev/Test Tiers) │

│ • Azure Storage (Private) • Service Bus Premium │

│ • Azure Container Registry • Cosmos DB │

│ • App Configuration • Event Grid │

│ (All accessed via Private Endpoints – no public internet access) │

│ CENTRAL MANAGEMENT & MONITORING │

│ • Log Analytics Workspace (Central) – All diagnostic logs sent here │

│ • Microsoft Defender for Cloud – Central security monitoring │

│ • Azure Monitor (Application Insights, VM Insights) │

│ • Microsoft Sentinel (SIEM) – Central security logging │

│ • Azure Automation Account – Central runbooks │

│

▼

│ EXTERNAL CONNECTIVITY │

│ Internet egress → Azure Firewall → Internet │

│ │

│ On-premises connectivity: │

│ • ExpressRoute Circuit → ExpressRoute Gateway │

│ • Site-to-Site VPN → VPN Gateway │

│ │

│ Developer Access: │

│ • Azure Bastion → VMs (no public IPs) │

│ • VPN/ExpressRoute → Corporate Network │

│ • Just-In-Time (JIT) VM Access via Defender for Cloud │

│ SECURITY CONTROLS │

│ • NSGs on all subnets (minimum required rules) │

│ • Azure Firewall Policy (centralized rule management) │

│ • Web Application Firewall (WAF) on Application Gateway if needed │

│ • DDoS Protection Standard on VNets │

│ • All traffic routed through Azure Firewall (UDRs: 0.0.0.0/0 → Firewall) │

│ • Private DNS Zones for all PaaS services │

│ COST OPTIMIZATION │

│ • Auto-shutdown schedules for non-production VMs │

│ • Spot VMs for CI/CD agents where possible │

│ • Dev/Test pricing for applicable services │

│ • Budget alerts and monitoring │

Key Architecture Principles Illustrated:

Hub-Spoke Topology: Centralized security and connectivity through Hub VNet
Traffic Flow: All internet egress through Azure Firewall
Private Connectivity: PaaS services via Private Endpoints only
Segmentation: Separate spokes for different environment purposes
Centralized Management: Logging, security, and monitoring centralized
Least Privilege Access: No public IPs on VMs, Bastion for access
Cost Control: Auto-shutdown and appropriate SKUs for non-prod

Traffic Flow Examples:

Dev VM to Internet:

text

VM → NSG → UDR → Azure Firewall → Internet

Dev App to Azure SQL:

text

App → Private Endpoint (in spoke) → Private Link → Azure SQL

Developer Access to VM:

text

Developer → VPN/ExpressRoute → Azure Bastion → VM (private IP)

Logging:

text

All resources → Diagnostic Settings → Log Analytics Workspace (central)

This design provides secure isolation while maintaining connectivity needed for development activities in a non-production environment.

Xxx

In Azure, routing determines how network traffic is directed between Azure resources, on-premises networks, and the internet. Here are the primary types and mechanisms of routing in Azure:

System Routes (Default Routes)

Automatically created by Azure for each subnet. They control traffic flow within a VNet and to/from the internet.

Local VNet routes: Traffic within the VNet
Internet route: Outbound traffic to the internet
Azure services: Direct connectivity to Azure services via service endpoints
Gateway routes: Routes to on-premises networks via VPN/ExpressRoute

User-Defined Routes (UDRs)

Custom route tables that override or extend system routes. Key use cases:

Forced tunneling: Route all internet-bound traffic through on-premises network
Network Virtual Appliances (NVAs): Direct traffic through firewalls or other appliances
Hub-and-spoke architectures: Control traffic flow between VNets
Service chaining: Route between virtual networks through NVAs

Border Gateway Protocol (BGP) Routes

Used with:

Azure VPN Gateway: Exchange routes with on-premises networks
ExpressRoute: Dynamic routing between on-premises and Azure
Virtual WAN: Automatic route propagation

Route Propagation Sources

Routes can come from multiple sources:

Virtual network gateway (VPN/ExpressRoute)
Network Virtual Appliance (via BGP or UDR)
Virtual network peering (automatic route exchange)
Azure Route Server (centralized routing management)

Route Types by Service

Virtual Network Routing

Subnet-to-subnet: Within same VNet
VNet-to-VNet: Via peering (system routes)
VNet-to-internet: Default internet egress

Hybrid Networking Routing

Site-to-Site VPN: Static or BGP routes
ExpressRoute: Private, Microsoft, and public peering
Azure Virtual WAN: Automated routing hub

Service-Specific Routing

Azure Load Balancer: Direct traffic to backend pools
Application Gateway: Path-based routing
Front Door: Global HTTP routing
Traffic Manager: DNS-based global routing

Routing Preferences

Microsoft global network: Optimized for Microsoft services
Internet routing: Lower-cost option
Cold potato routing vs Hot potato routing

Key Routing Concepts:

Longest prefix match: Azure selects the most specific route
Route priority: UDRs override system routes
Next hop types: Virtual appliance, VNet gateway, VNet peering, etc.
Route tables: Associated with subnets, not individual VMs

Common Routing Scenarios:

Hub-and-spoke with NVA inspection
Direct internet egress from specific subnets
Forced tunneling for compliance/security
Multi-region connectivity with optimal routing
Service chaining through multiple NVAs

Azure routing is hierarchical and deterministic, with User-Defined Routes taking precedence over system routes when there’s overlap.

This response is AI-generated, for reference only.

please give a description for each of the above

Comprehensive Description of Azure Routing Types

System Routes (Default Routes)

Description: Azure automatically creates and maintains these routes for every subnet in a Virtual Network. They cannot be created or removed manually but can be overridden by User-Defined Routes. System routes provide the fundamental connectivity that makes Azure networking work.

Key Routes:

Local VNet route: 0.0.0.0/0 → VNetLocal – Routes traffic between all IP addresses within the VNet’s address space. This enables direct communication between VMs in the same VNet without going through a gateway.
Internet route: 0.0.0.0/0 → Internet – Sends any traffic not destined for VNet IP addresses or Azure service endpoints to the internet. This is how VMs get outbound internet access.
Azure service virtual IPs: Specific IP ranges → Internet – Routes to Azure’s infrastructure services (like host node management traffic).
Virtual network peering routes: Automatically exchanged between peered VNets, appearing as VNetPeering next hop type.

Example: When VM1 (10.0.1.4) communicates with VM2 (10.0.2.4) in the same VNet, Azure uses the local VNet route for direct communication.

User-Defined Routes (UDRs)

Description: Custom route tables created by administrators to override or supplement system routes. UDRs are critical for implementing advanced network architectures and security controls.

Key Characteristics:

Associated with subnets (not individual VMs)
Higher priority than system routes (when routes overlap)
Support next hop types: Virtual Appliance, VNet Gateway, VNet Peering, Internet, or None
Enable forced tunneling (0.0.0.0/0 route to on-premises)

Common Use Cases:

Forced Tunneling Example:

text

Route Table: “Force-Tunnel-All”

Destination: 0.0.0.0/0

Next hop type: Virtual Network Gateway

Next hop IP: [VPN Gateway IP]

This sends all internet-bound traffic through your on-premises network for inspection.

NVA Inspection Example:

text

Route Table: “Inspection-Routes”

Destination: 10.20.0.0/16 (Spoke VNet)

Next hop type: Virtual Appliance

Next hop IP: 10.0.0.4 (Firewall VM)

Destination: 0.0.0.0/0 (Internet)

Next hop type: Virtual Appliance

Next hop IP: 10.0.0.4 (Firewall VM)

All traffic to spoke VNet and internet goes through the firewall.

Border Gateway Protocol (BGP) Routes

Description: A dynamic routing protocol that automatically exchanges network reachability information between networks. In Azure, BGP is used primarily for hybrid connectivity.

Implementation Scenarios:

Azure VPN Gateway with BGP:

On-premises router advertises local routes (192.168.1.0/24)
Azure VPN Gateway advertises VNet routes (10.0.0.0/16)
Both networks learn routes dynamically
If on-premises has multiple paths to Azure, BGP provides failover

ExpressRoute with BGP:

Private Peering: Advertises VNet routes to on-premises (10.0.0.0/16)
Microsoft Peering: Advertises public IP prefixes for Microsoft 365/Azure services
Automatic failover: If primary circuit fails, BGP reroutes traffic

Route Propagation: BGP-learned routes appear in the route table with next hop type “Virtual Network Gateway” and are automatically propagated to connected VNets.

Route Propagation Sources

Description: The origins from which routes are learned and distributed throughout Azure networking components.

Detailed Breakdown:

Virtual Network Gateway:

Propagates routes learned from on-premises via VPN/ExpressRoute
Can advertise Azure routes to on-premises
Supports both static and BGP routes

Network Virtual Appliance (NVA):

Can participate in BGP with Azure Route Server
Advertises routes to other network segments
Often used in hub-and-spoke to advertise default route to spokes

Virtual Network Peering:

Automatically exchanges routes between peered VNets
Non-transitive by default (spoke-to-spoke traffic goes through hub)
Global peering enables cross-region route exchange

Azure Route Server:

Centralized routing service that exchanges routes between NVAs and Azure
NVAs establish BGP sessions with Route Server
Route Server propagates NVA routes to all connected VNets

Route Types by Service

Virtual Network Routing

Subnet-to-Subnet: Direct routing within same VNet using system routes. No gateway needed.

VNet-to-VNet via Peering:

Routes automatically appear as VNetPeering next hop
Traffic stays on Azure backbone
Example: VNet A (10.1.0.0/16) peers with VNet B (10.2.0.0/16)

VNet-to-Internet:

Default outbound via public IP or Load Balancer
SNAT (Source Network Address Translation) performed
Can be restricted via NSGs or forced tunneling

Hybrid Networking Routing

Site-to-Site VPN:

Policy-based VPN: Static routes configured manually
Route-based VPN: Can use BGP for dynamic routing
Routes appear with VPN Gateway next hop

ExpressRoute:

text

Private Peering:

On-premises → Azure: 10.0.0.0/16

Azure → On-premises: 192.168.0.0/16

Microsoft Peering:

Azure → Customer: Public IP prefixes

Traffic doesn’t traverse the internet

Azure Virtual WAN:

Automated routing hub with transitive connectivity
Uses proprietary routing engine
Simplifies large-scale mesh networking

Service-Specific Routing

Azure Load Balancer:

Public Load Balancer: Routes to backend pool based on load balancing rules
Internal Load Balancer: Directs traffic within VNet

Application Gateway:

Path-based routing: /api/* to backend pool 1, /images/* to pool 2
Multi-site routing: blog.contoso.com and shop.contoso.com to different pools

Azure Front Door:

Global HTTP load balancer with Anycast
Routes to closest healthy backend
Supports latency-based and geographic routing

Traffic Manager:

DNS-based global load balancing
Routing methods: Priority, Weighted, Performance, Geographic
Doesn’t see actual traffic, only DNS queries

Routing Preferences

Description: Controls the path traffic takes between Azure and the internet.

Microsoft Global Network (Cold Potato Routing):

Keeps traffic on Microsoft’s backbone as long as possible
Better performance and reliability
Higher cost but optimized for Microsoft services
Example: Traffic from Azure East US to internet user in London stays on Microsoft network until London POP

Internet Routing (Hot Potato Routing):

Hands off to ISP as soon as possible
Lower cost, potentially higher latency
Used for internet egress and some PaaS services

Key Routing Concepts Explained

Longest Prefix Match:

text

Available routes:

10.0.0.0/16 → Virtual Appliance
10.0.1.0/24 → Internet
0.0.0.0/0 → Virtual Network Gateway

Traffic to 10.0.1.5 matches route #2 (more specific /24)

Traffic to 10.0.2.5 matches route #1 (more specific /16 than #3)

Traffic to 8.8.8.8 matches route #3 (only match)

Route Priority Hierarchy:

User-Defined Routes (most specific)
BGP Routes (from VPN/ExpressRoute)
System Routes
Default route (if no match)

Next Hop Types:

Virtual Appliance: VM with IP forwarding enabled
VNet Gateway: VPN or ExpressRoute gateway
VNet Peering: Another peered VNet
Internet: Azure infrastructure egress
None: Blackhole traffic (for security)

Common Routing Scenarios with Examples

Hub-and-Spoke with NVA Inspection

text

Hub VNet: 10.0.0.0/16

– Subnet: GatewaySubnet (VPN/ExpressRoute)

– Subnet: NVA-Subnet (Firewall: 10.0.0.4)

– Subnet: SharedServices (10.0.1.0/24)

Spoke1 VNet: 10.1.0.0/16 (peered with Hub)

Spoke2 VNet: 10.2.0.0/16 (peered with Hub)

Route Table on Spoke1:

0.0.0.0/0 → Virtual Appliance (10.0.0.4)

10.0.0.0/16 → VNetPeering (to Hub)

10.2.0.0/16 → Virtual Appliance (10.0.0.4)

All inter-spoke and internet traffic flows through hub firewall

Direct Internet Egress for Specific Subnet

text

Route Table: “Direct-Internet”

0.0.0.0/0 → Internet

Associated with: “Public-Facing-Subnet”

Not associated with: “Database-Subnet”

Only specific subnets can reach internet directly

Forced Tunneling for Compliance

text

Route Table: “Compliance-Routes”

0.0.0.0/0 → Virtual Network Gateway (to on-premises)

8.8.8.8/32 → Internet (exception for specific service)

All traffic inspected on-premises except DNS

Service Chaining

text

VM → Firewall (10.0.0.4) → IDS (10.0.0.5) → Internet

Routes:

0.0.0.0/0 → Virtual Appliance (10.0.0.4)

Firewall configured to send inspected traffic to IDS

IDS has route to internet

Multi-Region DR Routing

text

Primary Region: East US (10.1.0.0/16)

DR Region: West US (10.2.0.0/16)

Global Load Balancer health probes both regions

If East US fails, Traffic Manager updates DNS to point to West US

ExpressRoute advertises both routes with different BGP weights

Practical Considerations

Route Table Limits:

400 routes per route table
200 route tables per subscription
25 BGP peerings per VPN gateway

Routing Best Practices:

Use descriptive names for route tables
Document routing decisions and exceptions
Test routing changes in non-production first
Monitor route tables with Network Watcher
Implement routing incrementally

Troubleshooting Tools:

Network Watcher: Next hop analysis, IP flow verify
Effective Routes: View routes applied to NIC
Connection Troubleshoot: Test connectivity paths
Packet Capture: Analyze actual traffic flow

This comprehensive routing system enables Azure to support everything from simple web applications to complex global enterprise networks with multiple connectivity requirements.